Risk Management Process and ISO 14971

As device manufacturers we have the responsibility of ensuring that our products are safe before shipping them out the door. As such we are required to have a risk management process in place and to have evidence on hand that we have conducted a Hazard Analysis. It is probably the single most important design input process you can conduct and yet there are medical device manufacturers and service providers who do not conduct an appropriate evaluation or even worst – do not have a process implemented yet.

The process of dealing with hazards and risks are well defined in recent standards. Years ago the method of choice was Failure Mode and Effect Analysis – this has given way in the medical device field to the industry specific ISO 14971.

Before proceeding we should clarify some keywords and proper definitions. Often the words Hazard and Risk are used interchangeably. This is incorrect. At least for the purposes of this article:

Hazard will be defined as “a source of danger or harm”

And

Risk will be defined as “the probability of harm and occurrence”

THE PROCESS: IDENTIFY, ANALYZE AND MITIGATE

There is common sense lifecycle approach to dealing with hazards. In essence once you identify a hazard it is your responsibility to analyze and mitigate it prior to releasing your product. This is of course given that your product has not already been distributed on the market. In the event that the hazard has been identified post-release (usually initiated as a customer complaint) it is still the manufacturer’s responsibility to analyze and mitigate as well as follow applicable MDR requirements.

MANAGEMENT RESPONSIBILITY

Management has defined responsibilities per ISO 14971. Namely they are responsible for: Define a risk management policy; ensure that adequate resources are in place to handle risk activities; assign trained personnel and review results of all risk management activities.

...Next (more)........